I've been rug pulled twice and still alive, so I really have some PTSD about "security configurations"... Recently I saw cross-chain bridge hacks and oracle errors, and everyone just collectively says "wait for confirmation" as the consensus, which is both hilarious and sad.

Hardware wallets, to put it simply, are suitable for the stage where "the money is okay but I don't want to fuss too much": don't take photos of your seed phrase, don't store it on cloud drives. Just doing this much already makes me better than I was back in the day. If the assets get larger, I prefer multi-signature wallets, mainly to prevent myself from slipping up and to avoid single points of failure. The downside is that every operation feels like opening a safe—kind of annoying. Social recovery, I think, is more suitable for people who are afraid of locking themselves out, but you need to think clearly first: are the "friends" you choose truly friends or future social engineering entry points...

There are many tutorials. Now I only look at those that write the pitfalls very straightforwardly, preferably with failure cases included. Flashy configuration screenshots bore me after two pages anyway. That's it for now, taking it slow with small amounts.